This IP address has been reported a total of
1,699
times from
12 distinct
sources.
62.171.133.1 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
used credentials master/wasd via Go SSH client. Initial reconnaissance executed uname, nproc, and /p ...
show moreused credentials master/wasd via Go SSH client. Initial reconnaissance executed uname, nproc, and /proc/uptime queries to profile system architecture and resources. Attacker attempted to stage malware via SCP to writable directories (/dev/shm, /tmp, /var/tmp), then downloaded payload from hxxp://5[.]189[.]149[.]171/f/aarch64/.16 using curl with retry logic, falling back to wget. Downloaded binary named .16 executed with chmod +x in /dev/shm. Post-execution cleanup removed the malware file, cleared wtmp log, and deleted bash history to conceal activity. Commands wrapped in sudo with password piping indicate privilege escalation attempts. Attack chain shows automated deployment targeting multi-architecture systems (aarch64 variant requested), consistent with botnet propagation. Log tampering via wtmp truncation and history clearing demonstrates anti-forensics. Infrastructure at 5[.]189[.]149[.]171 hosting architecture-specific payloads suggests coordinated malware distribution campaign.
show less
Brute-force SSH login creds master/wasd via Go SSH client. Single session: recon + malware deploymen ...
show moreBrute-force SSH login creds master/wasd via Go SSH client. Single session: recon + malware deployment. Enumerated arch (uname -m), CPU (nproc), uptime (/proc/uptime) for payload selection. Downloaded aarch64 binary from hxxp://5[.]189[.]149[.]171/f/aarch64/ using curl+wget fallback with retry logic. File /home/<user>/.16 chmod +x. Persistence via sudoers (echo 'wasd' | sudo -S) for elevated exec. Post-exec deletion of /.16. Automated botnet recruitment pattern: arch profiling before payload delivery indicates multi-arch support. Purpose-built Go SSH tooling + retry logic + connrefused handling. No lateral movement observed. Temporary execution model (.16 filename, staging) typical of worm/botnet families. C2 at 5[.]189[.]149[.]171 hosting arch-specific binaries = organized malware campaign. Block C2 IP, monitor for similar arch-aware payload delivery.
show less
Credential exploitation using master/wasd. SSH-2.0-Go client executed reconnaissance commands across ...
show moreCredential exploitation using master/wasd. SSH-2.0-Go client executed reconnaissance commands across 2 sessions within 3 seconds. Host fingerprinting via uname -m, system uptime extraction from /proc/uptime, and CPU enumeration via nproc. PATH variable manipulation to enforce system-wide command scope. Incomplete CPU query suggests command truncation or session termination. No payload delivery, persistence mechanisms, or lateral movement observed in captured activity. Reconnaissance-only phase consistent with initial access probing post-credential compromise. Attack chain: credential brute-force success > shell access > system profiling for compatibility assessment. No downloads, file modifications, or exfiltration detected. Activity indicates attacker gathering host specifications, likely to determine if system matches requirements for subsequent malware deployment or botnet recruitment.
show less
SSH brute force (root/root, master/wasd) via Go client. SCP staged payloads in /dev/shm, /tmp, /var/ ...
show moreSSH brute force (root/root, master/wasd) via Go client. SCP staged payloads in /dev/shm, /tmp, /var/tmp. ARM64 binary ".16" dl'd from 5[.]189[.]149[.]171 via curl/wget with retries. Exec chain: /dev/shm, chmod +x, run. Post-exploit: wtmp zeroed, bash_history removed, history -c. Sudo privesc attempts on both accts. Secondary path: /home/<user>/.16 (wasd). bash -c fallbacks on sudo failures. SCP + direct dl dual staging. Log destruction indicates evasion awareness. No persistence observed beyond initial payload exec. Attack profile: automated botnet targeting Linux ARM64 servers/IoT devices.
show less
SSH brute-force attack using Go and paramiko_4.0.0 clients. Creds attempted: master/wasd, root/root. ...
show moreSSH brute-force attack using Go and paramiko_4.0.0 clients. Creds attempted: master/wasd, root/root. Attack chain: (1) SCP file transfer to /dev/shm, /tmp, /var/tmp; (2) Enumeration via echo $HOME, uname -m, /proc/uptime, nproc; (3) Privilege escalation via sudo password 'wasd'; (4) Payload dl from hxxp://5[.]189[.]149[.]171/f/aarch64/.16 using curl/wget with retries; (5) Exec via chmod +x; (6) Log sanitization—deletion of /.16 binary, wtmp truncation, bash history removal. .16 binary targets aarch64 arch, suggesting ARM IoT/embedded device or cross-platform botnet variant. Infrastructure 5[.]189[.]149[.]171 hosted architecture-specific malware. Commands enumerate CPU count and uptime before payload exec. Log destruction indicates persistent malware with anti-forensics. Successful exploitation yields arbitrary code exec with sudo privileges.
show less
Brute-force SSH attack using Go client with creds: master/wasd, root/root. Attacker opened 2 session ...
show moreBrute-force SSH attack using Go client with creds: master/wasd, root/root. Attacker opened 2 sessions attempting privilege escalation via sudo password injection. Attack chain: (1) Initial access weak creds; (2) Recon via echo $HOME; (3) Payload staging to /dev/shm, /tmp, /var/tmp using scp; (4) Malware dl attempts from 5[.]189[.]149[.]171/f/aarch64/.16 via curl/wget with retry logic and SSL bypass (--no-check-certificate); (5) Priv esc to exec .16 binary via sudo -S using compromised passwords; (6) Persistence/cleanup with chmod +x and rm -rf suggesting repeated execution and evidence removal. Binary .16 hosted on 5[.]189[.]149[.]171 is architecture-specific (aarch64), indicating multi-platform malware distribution infrastructure. Attack compressed to 91 seconds across 2 sessions, suggesting scripted/automated exploitation. Dual credential attempts and fallback dl mechanisms (curl OR wget) indicate mature botnet tooling. Pattern consistent with automated scanning and malware distribution.
show less
Single SSH session using root/root credentials with Go-based SSH client. Attacker executed reconnais ...
show moreSingle SSH session using root/root credentials with Go-based SSH client. Attacker executed reconnaissance commands gathering system architecture, uptime, and CPU count via uname, /proc/uptime, and nproc. PATH variable modified to ensure command accessibility across standard system directories. Activity indicates automated bot or scanner profiling target system specifications, likely for malware compatibility assessment or botnet recruitment evaluation. No persistence mechanisms, lateral movement, or payload deployment observed in this session. Standard reconnaissance footprint consistent with mass-scanning infrastructure targeting weak default credentials.
show less
logged in with default credentials root/root using Go SSH client. Performed reconnaissance: checked ...
show morelogged in with default credentials root/root using Go SSH client. Performed reconnaissance: checked $HOME, architecture (uname -m), CPU count (nproc), and system uptime (/proc/uptime). Downloaded malware payload .16 from hxxp://5[.]189[.]149[.]171/f/aarch64/.16 via curl or wget with retry logic to /dev/shm. Made executable with chmod +x. Executed payload at /home/<user>/.16 via sudo bash. Attempted cleanup with rm -rf. Attack chain shows standard dropper behavior: credential access > recon > malware retrieval > execution. Download server hosted architecture-specific binaries (aarch64 variant). No persistence mechanisms, lateral movement, or port forwarding observed in this session. Single-stage loader delivered from external C2 infrastructure.
show less
Two sessions with root/root credentials. SCP file transfer attempts to /dev/shm, /tmp, /var/tmp stag ...
show moreTwo sessions with root/root credentials. SCP file transfer attempts to /dev/shm, /tmp, /var/tmp staging directories. Attacker executed reconnaissance commands: uname -m, /proc/uptime parsing, nproc CPU enumeration, $HOME discovery. Downloaded malware variant .16 from hxxp://5[.]189[.]149[.]171/f/aarch64/ targeting aarch64 architecture, likely a botnet payload given the curl/wget fallback mechanism with retry logic (3 attempts, 1-second delays). Executed chmod +x and execution of /.16. Post-exploitation cleanup: deleted .16 binary, zeroed /var/log/wtmp, removed .bash_history, cleared command history with history -c. PATH manipulation attempted. Attack chain indicates automated botnet deployment with architecture-specific payload delivery and log sanitization. Multiple download locations suggest distributed hosting infrastructure. Go SSH client and paramiko indicate scripted/automated scanning and exploitation.
show less
Brute-Force
SSH
Showing 1 to
15
of 1699 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩